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DDA 78-3496/1 
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Fol 


MEMORANDUM FOR: Deputy Director for Administration 


25X1 FROM: 5 Ree 
Ssistant Lor imtormation, DDA 


SUBJECT: Third Annual Report on the Privacy Act. (CY 1977) 


1. Attached is OMB's annual report on the administration of the 
Privacy Act. Copies of the Presidential transmittal letter and the 
first five pages of the report have gone to the DCI, the DDCI, OGC, 
OLC, and the IG. 


2. I have gone through the report, hichlighting paragraphs of 
interest to us and any specific reference to CIA. I found only one 
problem of concern and this was on page 5 where we are cited as one of 
the agencies undertaking "zero based review of...internal programs, 
policies and directives.'' I have talked to the woman in OMB who was 
responsible for drafting this language, Leslie Greenspan, and she admits 
that the words were poorly chosen. The paragraph in question needs to 
be read in conjunction with the immediately preceding paragraph which 
speaks about preventing unnecessary new recordkeeping and eliminating 
unnecessary records. It is this effort with which CIA is associated. 
I see no reason at this stage to protest the misleading phrasing, but 
the point’ should be borne in mind in the unlikely évent that questions 
arise about CIA failure to follow through on an implied commitment. 


3. After you have scanned the report, I will send it down to IPS 
for their review. As for the principal injumction in the Presidential 
letter, I believe it is clear that the Agency program is already com- 
mitted to his stated goal of reducing "the amount of personal informa- 
tion collected and maintained by the Federal government [on U.S. citizens], 
to avoid unwarranted disclosure of this information, and to improve the 
internal management of personal data systems." 


25X1 


Attachment: a/s 


cc: OGC 
OLC 
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THE WHITE HOUSE eed Ce IFFT" 
WASHINGTON “e Laseeabne iE 


August. 31, 1978 . OLC #1-F05 O| 
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MEMORANDUM FOR THE HEADS OF | C¥ A 
EXECUTIVE DEPARTMENTS AND AGENCIES 


Enclosed for your information is a copy of the Third 
Arinual Report on executive branch administration of the 
Privacy Act of 1974, which I recently transmitted to the 
Congress. 


The protection of personal privacy is of great concern toa 
the American people, and an important priority of my 
Administration. I urge you to personally review this report 
and take steps to further improve your agency's administra- 
tion of the Privacy Act. 


The report indicates that many agencies have made substantial 
improvements in their implementation of the Act. [I urge 
each of you, however, to initiate additional efforts during 
the coming year to reduce the amount of personal information 
collected and maintained by the Federal government, to 

avoid unwarranted disclosure of this information, and to 
improve the internal management of personal data systems. 


I have asked the Director of the Office of Management and 
Budget to monitor these efforts and to keep me informed 
of your progress. , 


Foamy ade 
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The Privacy Act of 1974 (Public Law 93-579} provides that: 


"The President shall submit to the Speaker of the House 
and the President of the Senate, by June 30 of each 
calendar year, a consolidated report, separately listing 
for each Federal agency the number of records contained in 
any System of records which were exempted from the applica- 
tion of this section under the provisions of subsections 
(j) and (k) of this section during the preceding calendar 
year, and the reasons for the exemptions, and such other 
information as indicates efforts to administer fully this 

' section,” (€5 19S.c, 552a(p)). 


This, Third Annual Report of executive branch activities 
under the Privacy Act covers Operational experience during 
calendar year 1977. The report is based upon information 
supmiitted to OMB by executive branch agencies and OMB 
-experlences in Overseeing implementation of the Act. 


‘in recognition of a fundamental right of individual. privacy 
which is protected by the Constitution of the United States, 
the Privacy Act of 1974 established a system of checks and 
balances to regulate the collection, maintenance, use and 
Gissemination of personal information by the Federal Govern- 
ment in order to achieve a balance between the Government's 
need to know and the individual's right to privacy. Under 
‘the Act: 


“Individuals have a might-to: 


“Know about and review personal information maintained 
“about them by Federal agencies. 


Request that personal information which they believe 
to be incorrect be amended or corrected. 

“Appeal adverse agency decisions relative to requests 
“for amendment or correction, 


“Sue an agency in U. S. District Courts for violaticns 
Of the Act. 


Pederal departments and agencles are responsible for: 
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° Collecting and maintaining only that personal infor- 
mation which is relevant and necessarv. : 


° Maintaining personal data ina timely and accurate 
Manner, 


° Safeguarding personal data and limiting unauthorized 
aisclosure of such data. 

° Assuring adequate opportunities for public scrutiny 
and comment on agency personal recordkeeping oracticas, 


The Office of Management and Budget is responsible for: 


° Providing oversight and assistance to agencies in 
their implementation of the Act. 


II CONCLUSIONS 


The first two years of operation under the Privacy Act were 
Gevoted to the establishment of agency programs, policies 
and procedures for implementing the Act. special emphasis 
was placed on identifying and inventorying the nature and 
magnitude of personal data which is collected and maintained 
by the Federal Government. 


During 1977 many agencies undertook a comprehensive 
review of the types of data which they maintain ahout 
American citizens and their internal Programs for managing 
this data. 


Conclusious that can be drawn from experiences during 1977 
are: 


Q 


Many agencies continued to devote significant 
resources to refining their programs for 
administering personal data. 


° A number of agencies achieved significant reductions 
in the amount of personal data they maintain. 


° Federal personal recordkeeping remained fairly stable 
during 1977, with agency reduction efforts balanced b 
2 : - 4 
growth in the size of some systems of records. 


° Agencies are increasing their use of coinputers to main- 
tain versonal data. 
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° Public reporiking is involved in only S68 of 6,424 
Systems OF records (8.8%)", but these systems account 
for 48.9% of the total individuals’ records. 

° ‘There was 1 


ittle public comment received by Federal 
agencies duri 


ng 1977 relative to the Privacy Act. 


i 


“ The Federal Register is not an effective means for 


obtaining pu lic comment on agency privacy issuances. 


cost of publishing seine | Privacy Act notices in 

vederal Register 15 Sicnificent. 

7 Agenc i Les placed greater emphasis on safeguarding 
personal cata during 1977 


The use of exemptions did not change Sianificantly 
from 1976, 


° Exemptions were generally invoked on a case by case 
basis and were not used automatically to deny access 
to records. 


° The requirements to collect information directly from 


individuals have not adversely affected agency 
operations. 


sources has de ncreas ed in some areas. 


° Inconsistencies between Federal, State and local privac 


iaws have created some problems. 


¥ 


° Most requests for access to records were made by members 


of the general public, and not Federal employees. 
* More than 95% of all ESGNESCs for access were granted. 


$e The number of ieeeaaes filed under the Privacy Act in 
1977 was twice the number filed in 1976 (141 vs 69). 


Tif SUMMARY OF ACCOMPLISHMENTS AND FUTURE PLANS 


Accomplishments 


Federal activities during 1977 were directed towards the 
=ee duction Of versonal data maintained by Federal agencies 
in order to reduce unnecessary Government intrusion into 
the private lives of Pa Cen and reduce the cost and 
burden of public reporting. This effort was initiated by 
she Director of OMB in a fetter Gated March 7, 2997 an 
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which the heads of aach executive department and agency 
were requested to develop plans for eliminating or cur~ 
tailing systems which contained personal information. 
Special letters were also sent to the heads of 1? major 
recordkeeping agencies, asking them to place a high 
priority on reducing the amount of personal data main- 
tained by each agency. Among the results of this effort 
were: 


° The Department of Defense, primarily through the 
elimination of duplicate records, reduced its 
number of systems from 2,219 to 2,150 and the 
number of individual records from 321.3 million 
to 296.7 million. 


* The Department of Commerce eliminated eight systems 
and reduced the number of individual records by 
14.3 million. 


° The General Sarvices Administration was able ta 
eliminate 14 svstems of records (15% of their 
total) and reduce their records on individuals 
by 44% (from 3.4 million to 1.5 million). 


The Department of Transportation eliminated 19 
systems of records. j 


°* The Civil Service Commission reduced the number 
of records it maintained from 103.3 million to 
87.8 million (153), but the majority of this was 
due to better estimates on the magnitude of 
recordkeeping. 


The Selective Service System reported that it eliminated © 
1.8 million draft records during 1977. ; 


A number of small agencies concluded that it was not 
feasible to reduce their personal recordkeeping since 
they were only collecting and maintaining the minimum 
personal information necessary to perform their mission. 


Future Plans 


Privacy Act activities during 1977 concentrated on a 
reduction in the number of systems and amount of data 
on individuals maintained by the Federal Government. 
Puture activities will continue these efforts and con- 
centrate on improving the management of personal data aa 
to assure compliance with the letter and spirit of the 
Privacy Act. : 
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° Agencies have been encouraged to make their review 
of personal recordkeeping a continuing high priority 
process to assure that unnecessary new recordkeeping 
is prevented and that existing records, as they 
become unnecessary, are eliminated. The Departments 
of Labor and Commerce, and other agencies, have 
already committed themselves to this effort. 


In conjunction with the above action, agencies have 
been encouraged to undertake a qualitative zero-based 
review of their internal programs, policies and 
directives for administering the Privacy Act. The 
CIA, DOE, HEW, CSC, DOT and several other agencies 
have indicated their intent to conduct these intensive 
reviews during 1978. 


The Department of Defense has a program underway to 
review data collection forms in order to eliminate 
redundant data elements. This should significantly 
reduce the amount of data collected from DOD employees, 
“who axe the primary subjects of DOD record systems. 


The Department of Commerce is reviewing six major 
systems of records for possible elimination in 1978. 


The General Services Administration and the Department 
of Transportation are both continuing their reviews 
and anticipate further reductions. 


The Selective Service System expects to eliminate an 
additional 8 million records during 1978. 


“®. During 1978 OMB will issue a government-wide computer 
. security policy. 
There is currently underway a Presidential Privacy 
Initiative to identify further actions for protecting 
individual privacy. The basis for this study is the 
final report of the Privacy Protection Study Commission. 
. The Domestic Policy Staff, OMB and other agencies are 
- participating in this effort. 


During 1978 the Federal Data Processing Reorganization 
Project will release its final report on the Federal 
“Government's acquisition, management and use of 
‘computers. A portion of this report specifically 
addresses privacy and confidentiality issues. 
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